diff --git a/src/cron.js b/src/cron.js
index f0719ccda..741a06b8b 100644
--- a/src/cron.js
+++ b/src/cron.js
@@ -204,7 +204,7 @@ function boxAutoupdatePatternChanged(pattern) {
             var updateInfo = updateChecker.getUpdateInfo();
             if (updateInfo.box) {
                 debug('Starting autoupdate to %j', updateInfo.box);
-                updater.updateToLatest(auditSource.CRON, NOOP_CALLBACK);
+                updater.updateToLatest({ skipBackup: false }, auditSource.CRON, NOOP_CALLBACK);
             } else {
                 debug('No box auto updates available');
             }
diff --git a/src/routes/cloudron.js b/src/routes/cloudron.js
index a994efadc..0417cf1b9 100644
--- a/src/routes/cloudron.js
+++ b/src/routes/cloudron.js
@@ -57,8 +57,10 @@ function getDisks(req, res, next) {
 }
 
 function update(req, res, next) {
+    if ('skipBackup' in req.body && typeof req.body.skipBackup !== 'boolean') return next(new HttpError(400, 'skipBackup must be a boolean'));
+
     // this only initiates the update, progress can be checked via the progress route
-    updater.updateToLatest(auditSource.fromRequest(req), function (error, taskId) {
+    updater.updateToLatest(req.body, auditSource.fromRequest(req), function (error, taskId) {
         if (error && error.reason === UpdaterError.ALREADY_UPTODATE) return next(new HttpError(422, error.message));
         if (error && error.reason === UpdaterError.BAD_STATE) return next(new HttpError(409, error.message));
         if (error) return next(new HttpError(500, error));
diff --git a/src/routes/sysadmin.js b/src/routes/sysadmin.js
index c400ed020..a44f308d0 100644
--- a/src/routes/sysadmin.js
+++ b/src/routes/sysadmin.js
@@ -38,7 +38,7 @@ function update(req, res, next) {
     debug('triggering update');
 
     // this only initiates the update, progress can be checked via the progress route
-    updater.updateToLatest(auditSource.SYSADMIN, function (error, taskId) {
+    updater.updateToLatest({ skipBackup: false }, auditSource.SYSADMIN, function (error, taskId) {
         if (error && error.reason === UpdaterError.ALREADY_UPTODATE) return next(new HttpError(422, error.message));
         if (error && error.reason === UpdaterError.BAD_STATE) return next(new HttpError(409, error.message));
         if (error) return next(new HttpError(500, error));
diff --git a/src/updater.js b/src/updater.js
index 563240d8a..18e2ab961 100644
--- a/src/updater.js
+++ b/src/updater.js
@@ -154,8 +154,9 @@ function downloadAndVerifyRelease(updateInfo, callback) {
     });
 }
 
-function update(boxUpdateInfo, progressCallback, callback) {
+function update(boxUpdateInfo, options, progressCallback, callback) {
     assert(boxUpdateInfo && typeof boxUpdateInfo === 'object');
+    assert(options && typeof options === 'object');
     assert.strictEqual(typeof progressCallback, 'function');
     assert.strictEqual(typeof callback, 'function');
 
@@ -164,9 +165,15 @@ function update(boxUpdateInfo, progressCallback, callback) {
     downloadAndVerifyRelease(boxUpdateInfo, function (error, packageInfo) {
         if (error) return callback(error);
 
-        progressCallback({ percent: 10, message: 'Backing up' });
+        function maybeBackup(next) {
+            if (options.skipBackup) return next();
 
-        backups.backupBoxAndApps((progress) => progressCallback({ percent: 10+progress.percent*70/100, message: progress.message }), function (error) {
+            progressCallback({ percent: 10, message: 'Backing up' });
+
+            backups.backupBoxAndApps((progress) => progressCallback({ percent: 10+progress.percent*70/100, message: progress.message }), next);
+        }
+
+        maybeBackup(function (error) {
             if (error) return callback(error);
 
             debug('updating box %s', boxUpdateInfo.sourceTarballUrl);
@@ -201,7 +208,8 @@ function canUpdate(boxUpdateInfo, callback) {
     });
 }
 
-function updateToLatest(auditSource, callback) {
+function updateToLatest(options, auditSource, callback) {
+    assert.strictEqual(typeof options, 'object');
     assert.strictEqual(typeof auditSource, 'object');
     assert.strictEqual(typeof callback, 'function');
 
@@ -215,7 +223,7 @@ function updateToLatest(auditSource, callback) {
         error = locker.lock(locker.OP_BOX_UPDATE);
         if (error) return callback(new UpdaterError(UpdaterError.BAD_STATE, `Cannot update now: ${error.message}`));
 
-        let task = tasks.startTask(tasks.TASK_UPDATE, [ boxUpdateInfo ]);
+        let task = tasks.startTask(tasks.TASK_UPDATE, [ boxUpdateInfo, options ]);
         task.on('error', (error) => callback(new UpdaterError(UpdaterError.INTERNAL_ERROR, error)));
         task.on('start', (taskId) => {
             eventlog.add(eventlog.ACTION_UPDATE, auditSource, { taskId, boxUpdateInfo });